Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]dm thin: Fix UAF in run_timer_softirq()[EOL][EOL]When dm_resume() and dm_destroy() are concurrent, it will[EOL]lead to UAF, as follows:[EOL][EOL] BUG: KASAN: use-after-free in __run_timers+0x173/0x710[EOL] Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0[EOL]<snip>[EOL] Call Trace:[EOL]  <IRQ>[EOL]  dump_stack_lvl+0x73/0x9f[EOL]  print_report.cold+0x132/0xaa2[EOL]  _raw_spin_lock_irqsave+0xcd/0x160[EOL]  __run_timers+0x173/0x710[EOL]  kasan_report+0xad/0x110[EOL]  __run_timers+0x173/0x710[EOL]  __asan_store8+0x9c/0x140[EOL]  __run_timers+0x173/0x710[EOL]  call_timer_fn+0x310/0x310[EOL]  pvclock_clocksource_read+0xfa/0x250[EOL]  kvm_clock_read+0x2c/0x70[EOL]  kvm_clock_get_cycles+0xd/0x20[EOL]  ktime_get+0x5c/0x110[EOL]  lapic_next_event+0x38/0x50[EOL]  clockevents_program_event+0xf1/0x1e0[EOL]  run_timer_softirq+0x49/0x90[EOL]  __do_softirq+0x16e/0x62c[EOL]  __irq_exit_rcu+0x1fa/0x270[EOL]  irq_exit_rcu+0x12/0x20[EOL]  sysvec_apic_timer_interrupt+0x8e/0xc0[EOL][EOL]One of the concurrency UAF can be shown as below:[EOL][EOL]        use                                  free[EOL]do_resume                            ([EOL)  __find_device_hash_cell           |EOL]    dm_get                           ([EOL)      atomic_inc(&md->holders)      |EOL]                                     ( dm_destroy[EOL)                                    |   __dm_destroyEOL]                                     (     if (!dm_suspended_md(md))[EOL)                                    |     atomic_read(&md->holders)EOL]                                     (     msleep(1)[EOL)  dm_resume                         |EOL]    __dm_resume                      ([EOL)      dm_table_resume_targets       |EOL]        pool_resume                  ([EOL)          do_waker  #add delay work |EOL]  dm_put                             ([EOL)    atomic_dec(&md->holders)        |EOL]                                     (     dm_table_destroy[EOL)                                    |       pool_dtrEOL]                                     (         __pool_dec[EOL)                                    |           __pool_destroyEOL]                                     (             destroy_workqueue[EOL)                                    |             kfree(pool) # free pool[EOL]        time out[EOL]__do_softirq[EOL]  run_timer_softirq # pool has already been freed[EOL][EOL]This can be easily reproduced using:[EOL]  1. create thin-pool[EOL]  2. dmsetup suspend pool[EOL]  3. dmsetup resume pool[EOL]  4. dmsetup remove_all # Concurrent with 3[EOL][EOL]The root cause of this UAF bug is that dm_resume() adds timer after[EOL]dm_destroy() skips cancelling the timer because of suspend status.[EOL]After timeout, it will call run_timer_softirq(), however pool has[EOL]already been freed. The concurrency UAF bug will happen.[EOL][EOL]Therefore, cancelling timer again in __pool_destroy().

CVEs

• CVE-2022-50563